Skip to content

Commit 64e55a8

Browse files
rolyonrolyon
committed
Refresh Azure Red Hat OpenShift roles
1 parent 86d78e0 commit 64e55a8

File tree

2 files changed

+28
-6
lines changed

2 files changed

+28
-6
lines changed

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -213,7 +213,7 @@ The following table provides a brief description of each built-in role. Click th
213213
> | <a name='azure-red-hat-openshift-cloud-controller-manager'></a>[Azure Red Hat OpenShift Cloud Controller Manager](./built-in-roles/containers.md#azure-red-hat-openshift-cloud-controller-manager) | Manage and update the cloud controller manager deployed on top of OpenShift. | a1f96423-95ce-4224-ab27-4e3dc72facd4 |
214214
> | <a name='azure-red-hat-openshift-cluster-ingress-operator'></a>[Azure Red Hat OpenShift Cluster Ingress Operator](./built-in-roles/containers.md#azure-red-hat-openshift-cluster-ingress-operator) | Manage and configure the OpenShift router. | 0336e1d3-7a87-462b-b6db-342b63f7802c |
215215
> | <a name='azure-red-hat-openshift-disk-storage-operator'></a>[Azure Red Hat OpenShift Disk Storage Operator](./built-in-roles/containers.md#azure-red-hat-openshift-disk-storage-operator) | Install Container Storage Interface (CSI) drivers that enable your cluster to use Azure Disks. Set OpenShift cluster-wide storage defaults to ensure a default storageclass exists for clusters. | 5b7237c5-45e1-49d6-bc18-a1f62f400748 |
216-
> | <a name='azure-red-hat-openshift-federated-credential'></a>[Azure Red Hat OpenShift Federated Credential](./built-in-roles/containers.md#azure-red-hat-openshift-federated-credential) | Update cluster managed identities with a federated credential to build a trust relationship between the managed identity, OpenID Connect (OIDC), and the service account. | ef318e2a-8334-4a05-9e4a-295a196c6a6e |
216+
> | <a name='azure-red-hat-openshift-federated-credential'></a>[Azure Red Hat OpenShift Federated Credential](./built-in-roles/containers.md#azure-red-hat-openshift-federated-credential) | Create, update and delete federated credentials on user assigned managed identities in order to build a trust relationship between the managed identity, OpenID Connect (OIDC), and the service account. | ef318e2a-8334-4a05-9e4a-295a196c6a6e |
217217
> | <a name='azure-red-hat-openshift-file-storage-operator'></a>[Azure Red Hat OpenShift File Storage Operator](./built-in-roles/containers.md#azure-red-hat-openshift-file-storage-operator) | Install Container Storage Interface (CSI) drivers that enable your cluster to use Azure Files. Set OpenShift cluster-wide storage defaults to ensure a default storageclass exists for clusters. | 0d7aedc0-15fd-4a67-a412-efad370c947e |
218218
> | <a name='azure-red-hat-openshift-image-registry-operator'></a>[Azure Red Hat OpenShift Image Registry Operator](./built-in-roles/containers.md#azure-red-hat-openshift-image-registry-operator) | Enables permissions for the operator to manage a singleton instance of the OpenShift image registry. It manages all configuration of the registry, including creating storage. | 8b32b316-c2f5-4ddf-b05b-83dacd2d08b5 |
219219
> | <a name='azure-red-hat-openshift-machine-api-operator'></a>[Azure Red Hat OpenShift Machine API Operator](./built-in-roles/containers.md#azure-red-hat-openshift-machine-api-operator) | Manage the lifecycle of specific-purpose custom resource definitions (CRD), controllers, and Azure RBAC objects that extend the Kubernetes API to declares the desired state of machines in a cluster. | 0358943c-7e01-48ba-8889-02cc51d78637 |

‎articles/role-based-access-control/built-in-roles/containers.md

Lines changed: 27 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2166,6 +2166,10 @@ Manage and update the cloud controller manager deployed on top of OpenShift.
21662166
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/publicIPAddresses/write | Creates a public IP address or updates an existing public IP address. |
21672167
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/join/action | Joins a virtual network. Not Alertable. |
21682168
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/read | Gets a virtual network subnet definition |
2169+
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/inboundNatRules/join/action | Joins a load balancer inbound nat rule. Not Alertable. |
2170+
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkSecurityGroups/join/action | Joins a network security group. Not Alertable. |
2171+
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/publicIPPrefixes/join/action | Joins a PublicIPPrefix. Not alertable. |
2172+
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/applicationSecurityGroups/joinNetworkSecurityRule/action | Joins a Security Rule to Application Security Groups. Not alertable. |
21692173
> | **NotActions** | |
21702174
> | *none* | |
21712175
> | **DataActions** | |
@@ -2196,7 +2200,11 @@ Manage and update the cloud controller manager deployed on top of OpenShift.
21962200
"Microsoft.Network/publicIPAddresses/read",
21972201
"Microsoft.Network/publicIPAddresses/write",
21982202
"Microsoft.Network/virtualNetworks/subnets/join/action",
2199-
"Microsoft.Network/virtualNetworks/subnets/read"
2203+
"Microsoft.Network/virtualNetworks/subnets/read",
2204+
"Microsoft.Network/loadBalancers/inboundNatRules/join/action",
2205+
"Microsoft.Network/networkSecurityGroups/join/action",
2206+
"Microsoft.Network/publicIPPrefixes/join/action",
2207+
"Microsoft.Network/applicationSecurityGroups/joinNetworkSecurityRule/action"
22002208
],
22012209
"notActions": [],
22022210
"dataActions": [],
@@ -2327,14 +2335,15 @@ Install Container Storage Interface (CSI) drivers that enable your cluster to us
23272335

23282336
## Azure Red Hat OpenShift Federated Credential
23292337

2330-
Update cluster managed identities with a federated credential to build a trust relationship between the managed identity, OpenID Connect (OIDC), and the service account.
2338+
Create, update and delete federated credentials on user assigned managed identities in order to build a trust relationship between the managed identity, OpenID Connect (OIDC), and the service account.
23312339

23322340
> [!div class="mx-tableFixed"]
23332341
> | Actions | Description |
23342342
> | --- | --- |
23352343
> | [Microsoft.ManagedIdentity](../permissions/identity.md#microsoftmanagedidentity)/userAssignedIdentities/read | Gets an existing user assigned identity |
23362344
> | [Microsoft.ManagedIdentity](../permissions/identity.md#microsoftmanagedidentity)/userAssignedIdentities/federatedIdentityCredentials/write | Add or update a Federated Identity Credential |
23372345
> | [Microsoft.ManagedIdentity](../permissions/identity.md#microsoftmanagedidentity)/userAssignedIdentities/federatedIdentityCredentials/read | Get or list Federated Identity Credentials |
2346+
> | [Microsoft.ManagedIdentity](../permissions/identity.md#microsoftmanagedidentity)/userAssignedIdentities/federatedIdentityCredentials/delete | Delete a Federated Identity Credential |
23382347
> | **NotActions** | |
23392348
> | *none* | |
23402349
> | **DataActions** | |
@@ -2347,15 +2356,16 @@ Update cluster managed identities with a federated credential to build a trust r
23472356
"assignableScopes": [
23482357
"/"
23492358
],
2350-
"description": "Update cluster managed identities with a federated credential to build a trust relationship between the managed identity, OpenID Connect (OIDC), and the service account.",
2359+
"description": "Create, update and delete federated credentials on user assigned managed identities in order to build a trust relationship between the managed identity, OpenID Connect (OIDC), and the service account.",
23512360
"id": "/providers/Microsoft.Authorization/roleDefinitions/ef318e2a-8334-4a05-9e4a-295a196c6a6e",
23522361
"name": "ef318e2a-8334-4a05-9e4a-295a196c6a6e",
23532362
"permissions": [
23542363
{
23552364
"actions": [
23562365
"Microsoft.ManagedIdentity/userAssignedIdentities/read",
23572366
"Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write",
2358-
"Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read"
2367+
"Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read",
2368+
"Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete"
23592369
],
23602370
"notActions": [],
23612371
"dataActions": [],
@@ -2386,6 +2396,8 @@ Install Container Storage Interface (CSI) drivers that enable your cluster to us
23862396
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkSecurityGroups/join/action | Joins a network security group. Not Alertable. |
23872397
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/read | Gets a virtual network subnet definition |
23882398
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/write | Creates a virtual network subnet or updates an existing virtual network subnet |
2399+
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/routeTables/join/action | Joins a route table. Not Alertable. |
2400+
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/natGateways/join/action | Joins a NAT Gateway |
23892401
> | **NotActions** | |
23902402
> | *none* | |
23912403
> | **DataActions** | |
@@ -2414,7 +2426,9 @@ Install Container Storage Interface (CSI) drivers that enable your cluster to us
24142426
"Microsoft.Storage/storageAccounts/write",
24152427
"Microsoft.Network/networkSecurityGroups/join/action",
24162428
"Microsoft.Network/virtualNetworks/subnets/read",
2417-
"Microsoft.Network/virtualNetworks/subnets/write"
2429+
"Microsoft.Network/virtualNetworks/subnets/write",
2430+
"Microsoft.Network/routeTables/join/action",
2431+
"Microsoft.Network/natGateways/join/action"
24182432
],
24192433
"notActions": [],
24202434
"dataActions": [],
@@ -2531,6 +2545,10 @@ Manage the lifecycle of specific-purpose custom resource definitions (CRD), cont
25312545
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/read | Get the virtual network definition |
25322546
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/join/action | Joins a virtual network. Not Alertable. |
25332547
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/read | Gets a virtual network subnet definition |
2548+
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/applicationSecurityGroups/joinNetworkSecurityRule/action | Joins a Security Rule to Application Security Groups. Not alertable. |
2549+
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/frontendIPConfigurations/join/action | Joins a Load Balancer Frontend IP Configuration. Not alertable. |
2550+
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/loadBalancers/inboundNATRules/join/action | Joins a load balancer inbound nat rule. Not Alertable. |
2551+
> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkSecurityGroups/join/action | Joins a network security group. Not Alertable. |
25342552
> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
25352553
> | **NotActions** | |
25362554
> | *none* | |
@@ -2582,6 +2600,10 @@ Manage the lifecycle of specific-purpose custom resource definitions (CRD), cont
25822600
"Microsoft.Network/virtualNetworks/read",
25832601
"Microsoft.Network/virtualNetworks/subnets/join/action",
25842602
"Microsoft.Network/virtualNetworks/subnets/read",
2603+
"Microsoft.Network/applicationSecurityGroups/joinNetworkSecurityRule/action",
2604+
"Microsoft.Network/loadBalancers/frontendIPConfigurations/join/action",
2605+
"Microsoft.Network/loadBalancers/inboundNATRules/join/action",
2606+
"Microsoft.Network/networkSecurityGroups/join/action",
25852607
"Microsoft.Resources/subscriptions/resourceGroups/read"
25862608
],
25872609
"notActions": [],

0 commit comments

Comments
 (0)